I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s

I am facing a problem when i try to put a break point on functions in ntdll, when i double click c:\windows\system32\ntdll.dll in the modules windows I get warning saying "Module c:\windows\system32\ntdll.dll has no names". When i right click on c:\windows\system32\ntdll.dll in the modules window and select load debug symbols, it downloads something but I am still not able to see the functions i would like to put break point on like NtResumeThread.

Appreciate any assistance or suggestions. Picenter image description here attached for reference.enter image description here

  • 3
    I'm voting to close this question as off-topic because this is better of at Hex Rays support (hex-rays.com/products/ida/support) – Nordwald Jan 25 '19 at 9:37
  • Hi and welcome to RE.SE. Wait, what's your problem here? From user mode the Zw* and Nt* functions are literally identical. Just their names differ, entry points to the kernel will be identical. And typically they are exported in pairs, so that's somewhat odd in your case. But still placing a bpx on ZwResumeThread should do the job. Also, your question lacks details such as what exact environment you were running in. – 0xC0000022L Jan 28 '19 at 10:44

Simply set the breakpoint on ZwResumeThread (also shown in your screenshot). From user mode the only difference between NtResumeThread and ZwResumeThread is the name prefix. In kernel mode these functions (of ntoskrnl.exe instead of ntdll.dll) have implementation differences indeed.

You may want to brush up on Windows internals a bit. This article by Geoff Chappell may help.

Not the answer you're looking for? Browse other questions tagged or ask your own question.